feat(scripts): group-owned script admin API + pic scripts … --group

Phase 4-lite C2. Lets a group own scripts (templates inherited by descendant
apps), with the create/list/manage surface — but not yet the inherited
resolution (binding + runtime), which is C3.

Capabilities: add `GroupScriptsRead` (viewer+ on the group → script:read) and
`GroupScriptsWrite` (editor+ → script:write), mirroring the group-vars tier and
resolved through the same group-ancestor walk.

API:
  * New `group_scripts_api`: `POST/GET /groups/{id}/scripts` — create a
    group-owned endpoint script and list a group's own (non-inherited) rows.
    Phase 4-lite is endpoint-only and self-contained: `kind=module` and any
    `import` are rejected (group modules + the lexical resolver are Phase 4b).
    Owner resolved first (slug-or-uuid); capability bound to the resolved id.
  * The by-id `/scripts/{id}` get/update/delete/logs handlers are now
    owner-polymorphic via a `script_cap` helper: app-owned scripts gate on
    `App*` exactly as before; group-owned on `GroupScripts*`. This is what
    makes `deploy --group` idempotent (update reuses the by-id PUT) and lets a
    group script be deleted by id. (C1 had these fail closed for groups.)

Repo: `list_for_group(group_id)` (the group's own rows).

CLI: `pic scripts ls --group <g>`, `pic scripts deploy --group <g>` (create or
update by name; `--app`/`--group` are mutually exclusive, exactly one
required). `pic scripts delete <id>` already works for group scripts via the
owner-polymorphic by-id route.

Live-validated against the dev DB: create → update (v2 via the by-id PUT) →
list → delete, plus module rejection and the polymorphic row shape
(`app_id NULL`, `group_id` set). Group scripts still can't be routed/triggered
or invoked — that lands in C3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/src/client.rs

@@ -309,6 +309,33 @@ impl Client {
         decode(resp).await
     }
 
+    /// `GET /api/v1/admin/groups/{id_or_slug}/scripts` — a group's own
+    /// scripts (Phase 4). Not inherited; just the group's rows.
+    pub async fn group_scripts_list(&self, group_ident: &str) -> Result<Vec<Script>> {
+        let g = seg(group_ident);
+        let resp = self
+            .request(Method::GET, &format!("/api/v1/admin/groups/{g}/scripts"))
+            .send()
+            .await?;
+        decode(resp).await
+    }
+
+    /// `POST /api/v1/admin/groups/{id_or_slug}/scripts` — create a
+    /// group-owned script (Phase 4).
+    pub async fn group_scripts_create(
+        &self,
+        group_ident: &str,
+        body: &CreateGroupScriptBody<'_>,
+    ) -> Result<Script> {
+        let g = seg(group_ident);
+        let resp = self
+            .request(Method::POST, &format!("/api/v1/admin/groups/{g}/scripts"))
+            .json(body)
+            .send()
+            .await?;
+        decode(resp).await
+    }
+
     /// `PUT /api/v1/admin/scripts/{id}` — matches the dashboard, which
     /// uses PUT despite the field-level update semantics. `cfg` carries
     /// optional per-script runtime overrides (G3); unset fields are
@@ -1637,6 +1664,24 @@ pub struct CreateScriptBody<'a> {
     pub sandbox: Option<ScriptSandbox>,
 }
 
+/// Phase 4: body for `POST /groups/{id}/scripts`. Like `CreateScriptBody`
+/// minus `app_id` — the owning group comes from the path.
+#[derive(Debug, Serialize)]
+pub struct CreateGroupScriptBody<'a> {
+    pub name: &'a str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<&'a str>,
+    pub source: &'a str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout_seconds: Option<i32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub memory_limit_mb: Option<i32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kind: Option<ScriptKind>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sandbox: Option<ScriptSandbox>,
+}
+
 #[derive(Debug, Serialize)]
 struct UpdateScriptBody<'a> {
     source: &'a str,